third_party/blink/web_tests/plugins/object-invalid-url-becomes-image-crash.html - manifest_repos/chromium_src - Git at Google

 <!DOCTYPE html>
 <script src="../resources/testharness.js"></script>
 <script src="../resources/testharnessreport.js"></script>
 <div id="container"></div>
 <script>
   var object = document.createElement("object");
   container.appendChild(object);
   object.data = "x";
   object.type = "image/webp";
   object.align = "Right";

   test(()=> { }, "No crash or DCHECK failure");
 </script>
	<!DOCTYPE html>
	<script src="../resources/testharness.js"></script>
	<script src="../resources/testharnessreport.js"></script>
	<div id="container"></div>
	<script>
	var object = document.createElement("object");
	container.appendChild(object);
	object.data = "x";
	object.type = "image/webp";
	object.align = "Right";

	test(()=> { }, "No crash or DCHECK failure");
	</script>